What permissions does CryptoBoost get on your Hyperliquid wallet?

How the connection works

Hyperliquid has a built-in way for trading tools to act on an account without holding it. It is called an API wallet. When you connect CryptoBoost, you:

1. Sign an API wallet approval with your own wallet. This authorises a new API wallet address to trade for your Hyperliquid account. You never share your private key or seed phrase.
2. Sign a fee approval with the same wallet. This lets CryptoBoost add its fee, at most 0.1%, to the orders it places for you. Hyperliquid collects it on each fill. See how the CryptoBoost fee works.
3. CryptoBoost uses the API wallet to sign orders. Hyperliquid checks that the API wallet is approved for your account, then executes the order in your account.
4. Everything settles in your account. Positions, margin and profit stay in your Hyperliquid balance the whole time.

Both approvals are recorded on Hyperliquid itself, not just on our servers, so you can see them and remove them from Hyperliquid directly.

What the bot can and cannot do

The "can never" column is enforced by Hyperliquid, not by a promise from us. Withdrawals and transfers need a signature from your own wallet, and the API wallet cannot produce one.

What the permission does not limit

Here is the full picture. A Hyperliquid API wallet is a trading permission, and Hyperliquid does not restrict it to one market. CryptoBoost's software trades only BTC perpetuals (BTC-PERP), but that is a rule in our system, not a limit enforced by Hyperliquid.

So the worst case is not "funds stolen". It is unwanted trading on your account. If you ever see activity you don't expect, revoke the API wallet and all trading stops at once. Your balance stays where it is.

To limit how much capital the bot can use, keep only your intended allocation in the account connected to CryptoBoost.

How to check and revoke access

You can switch the bot off from either side:

• In CryptoBoost: pause or disconnect the bot from your dashboard at app.cryptoboost.trade.
• In Hyperliquid: open the API page in the Hyperliquid app to see every API wallet authorised for your account, and remove the CryptoBoost one. After that, Hyperliquid rejects any order it signs.
• The fee: open app.hyperliquid.xyz/builderCodes (More → Builder Codes) to see or remove CryptoBoost's fee approval. Without it, the bot stops opening new positions but still closes open ones.

Revoking does not close your open positions. Those stay in your account for you to manage.

Verify it yourself

Every order the bot places is a normal Hyperliquid order in your account. You can see it in your Hyperliquid trade history and on the public explorer. Nothing about the record depends on trusting CryptoBoost.

Common questions